glupteba | 8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e | Triage

Submit
Reports

Overview

overview

Static

static

1

8630fe8ca6...0e.exe

windows7-x64

8630fe8ca6...0e.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e
Size

4.1MB
Sample

231011-y1jhmsag7w
MD5

ce18f08268a590c61b3dfa53671e6bbe
SHA1

c12884b4567055948be2c9fc71149ed940d1b32d
SHA256

8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e
SHA512

36bb39052aef8cacf3c40e29687a6161e6cb502561f8b5fcfe42d555072add1801af5cdc66b9b59fb865198160eec061514679bd9b6c228b45468464d7084de3
SSDEEP

98304:OulOjMwWieKLtWhsGCOdqTQ1dNJNLpRIsW:O/j3tIhCWqTWhRbW

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan

Static task

static1

Behavioral task

behavioral1

Sample

8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e.exe

Resource

win7-20230831-en

glupteba discovery dropper evasion loader persistence trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e.exe

Resource

win10v2004-20230915-en

glupteba discovery dropper evasion loader persistence rootkit

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e
- Size
  
  4.1MB
- MD5
  
  ce18f08268a590c61b3dfa53671e6bbe
- SHA1
  
  c12884b4567055948be2c9fc71149ed940d1b32d
- SHA256
  
  8630fe8ca62bb303ce75c74a45dcda599b1828533382aaffb55ed69bab42600e
- SHA512
  
  36bb39052aef8cacf3c40e29687a6161e6cb502561f8b5fcfe42d555072add1801af5cdc66b9b59fb865198160eec061514679bd9b6c228b45468464d7084de3
- SSDEEP
  
  98304:OulOjMwWieKLtWhsGCOdqTQ1dNJNLpRIsW:O/j3tIhCWqTWhRbW
Score

10^/10

glupteba discovery dropper evasion loader persistence trojan rootkit
- Glupteba
  Glupteba is a modular loader written in Golang with various components.
  loader dropper glupteba
- Glupteba payload
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Manipulates WinMonFS driver.
  Roottkits write to WinMonFS to hide directories/files from being detected.
  rootkit evasion
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gluptebadiscoverydropperevasionloaderpersistencetrojan

behavioral2

gluptebadiscoverydropperevasionloaderpersistencerootkit

© 2018-2025

Terms | Privacy